LEGAL

CB Payments & COINBASE UK PRIVACY POLICY

Last updated: March 13, 2018

CB Payments, Ltd, and Coinbase UK, Ltd ("CB", "we", "us" and "our")
respect and protect the privacy of visitors to our websites and our
customers who use our services. To ensure transparency, this Privacy
Policy describes our information handling practices when you access
content we own or operate on the websites located at
coinbase.com and
gdax.com, or any other websites, pages,
features, or content we own or operate (collectively, the "Site(s)")
and/or when you use the Coinbase mobile app, any Coinbase or GDAX API or
third party applications relying on such an API, and related services
(referred to collectively hereinafter as "Services").

Please take a moment to read this Privacy Policy carefully. If you have
any questions about this Privacy Notice, please contact us at
trust@coinbase.com.

ACCEPTANCE OF PRIVACY POLICY

By accessing and using our Services, you signify that you have reviewed
the terms of this Privacy Policy. Where we require your consent to
process your personal information, we will ask for your consent to the
collection, use, and disclosure of your personal information as
described further below. CB may provide additional "just-in-time"
disclosures or additional information about the data collection, use and
sharing practices of specific Services. These notices may supplement or
clarify CB's privacy practices or may provide you with additional
choices about how CB processes your data.

If you do not agree with or you are not comfortable with any aspect of
this Privacy Policy, you should immediately discontinue access or use of
our Services.

CHANGES TO THIS PRIVACY POLICY

We reserve the right to modify this Privacy Policy at any time, and when
required by law, we will notify you of changes to this Privacy Policy.
If we make any material changes we will notify you by email (sent to the
e-mail address specified in your account) or by means of a notice on our
Services prior to the change becoming effective.

OUR RELATIONSHIP TO YOU AND COINBASE

CB Payments, Ltd is a private limited company incorporated in England
and Wales with company number 09708629 and whose registered office is
9th Floor, 107 Cheapside, London EC2V 6DN, United Kingdom. CB Payments,
Ltd is an authorised electronic money institution authorised and
regulated by the UK Financial Conduct Authority ("FCA") with
register number 900635. CB Payments, Ltd is a data controller for
e-wallet transactions originating from the EEA. Coinbase UK, Ltd, is a
private limited company incorporated in England and Wales with company
number 09083955 and whose registered office is 9th Floor, 107 Cheapside,
London, EC2V 6DN.

Coinbase UK, Ltd, based in the United Kingdom and handles Digital
Currency transactions originating from the EEA. Coinbase UK, Ltd is the
data controller for cryptocurrency transactions. We provide instructions
to Coinbase, Inc. ("Coinbase"), to process such transactions on
[coinbase.com](gcoinbase.com)
and
[gdax.com](ggdax.com),
and to handle various administrative and organisational matters on our
behalf related to such transactions.

As data controllers, we determine the means and purposes of processing
data in relation to e-wallet and cryptocurrency transactions. If you
have any questions about your CB Account, your personal information or
this Privacy Policy, please direct your questions to
trust@coinbase.com.

PERSONAL INFORMATION WE COLLECT

Personal information is data that can be used to identify you directly
or indirectly, or to contact you. Our Privacy Policy covers all personal
information that you voluntarily submit to us and that we obtain from
our partners. This Privacy Policy does not apply to anonymised data, as
it cannot be used to identify you.

You may be asked to provide personal information anytime you are in
contact with any CB companies. The CB companies may share your personal
information with each other and use it consistent with this Privacy
Policy. They may also combine it with other information to provide and
improve our products, services, and content (see the section below).

Except as described in this Privacy Policy, CB will not give, sell, rent
or loan any personal Information to any third party.

PERSONAL INFORMATION COLLECTED

We collect personal information to provide you with our Services. When
we require certain personal information from users it is because such
information is relevant for specified purposes. Any information you
provide to us that is not required is voluntary.

For example, we collect personal information when you use or request
information about our Services, subscribe to marketing communications,
request support, complete surveys, or sign up for a CB event or webinar.
We may also collect personal information from you offline, such as when
you attend one of our events, or when you contact customer support. We
may use this information in combination with other information we
collect about you.

In addition, we may collect personal information disclosed by you on our
message boards, chat features, blogs and our other services to which you
are able to post information and materials. Any information that is
disclosed in those forums becomes public information and may therefore
appear in public ways, such as through search engines or other publicly
available platforms, and may be "crawled" or searched by third parties.
It could also be read, collected or used by other users to send you
unsolicited messages. Please do not post any information that you do not
want to reveal to the public at large.

You are free to choose whether to provide us with the types of personal
information described below, but we may not be able to serve you as
effectively or offer you some or all of our Services when you choose not
to share certain information with us.

Here are some examples of the types of personal information CB collects
and how we may use it:

When you create an account or use CB Services, we, or our
affiliates' vendors acting on our behalf may collect the following
types of information: your name, date of birth, driver number ID,
personal ID, address, phone, email, full bank account details and/or
credit card numbers that you link to your Coinbase Account or input
when you use CB Services. CB will use this information to fulfill
your requests and provide the relevant Services.

If you seek permissions to raise Digital Currency buy and sell
limits associated with your Coinbase Account, we may require you to
provide additional information which we may use in collaboration
with service providers acting on our behalf to verify your identity
or address, and/or to manage risk. This information may include your
date of birth, taxpayer or government identification number, a copy
of your government-issued identification, a photo of you, or other
personal information. We may also obtain information about you from
third parties such as credit bureaus and identity
verification services.

Whenever you contact us or respond to our communications (e.g.,
email, telephone, written), we receive your contact information and
any other personal information you choose to provide us. CB will use
such information to fulfill your requests or to provide Services.

You may choose to provide us with access to certain personal
information stored by third parties such as social media sites (such
as Facebook and Twitter). The information we have access to varies
by site and is controlled by your privacy settings on that site and
your authorisation.

HOW PERSONAL INFORMATION IS USED

Our primary purpose in collecting personal information is to provide you
with a secure, smooth, efficient, and customised experience. In general,
we use personal information to create, develop, operate, deliver, and
improve our Services, content and advertising, and for loss prevention
and anti-fraud purposes. Examples of how we may use this information
include:

To provide you with CB Services and customer support that
you request.

We will not use your personal information for purposes other than those
purposes we have disclosed to you, without your permission. From time to
time we may request your permission to allow us to share your personal
information with third parties. You may choose not to have your personal
information shared with third parties where we rely on consent as the
lawful basis for processing your personal information. You may also
choose not to allow us to use your personal information for any purpose
that is incompatible with the purposes for which we originally collected
it or subsequently obtained your authorisation. If you choose to limit
the use of your personal information, certain features or CB Services
may not be available to you.

INFORMATION FROM THIRD PARTY SOURCES

From time to time, we may obtain information about you from third party
sources as permitted by applicable law, such as public databases, credit
bureaus, ID verification partners, resellers and channel partners, joint
marketing partners, and social media platforms.

Public Databases, Credit Bureaus & ID Verification Partners: We
obtain information about you from public databases and ID
verification partners for purposes of verifying your identity. ID
verification partners use a combination of government records and
publically available information about you to verify your identity.
Such information includes your name, address, job role, public
employment profile, credit history, status on any sanctions lists
maintained by public authorities, and other relevant data. The legal
basis for such processing is to comply with our legal obligations,
such as anti-money laundering laws. In some cases, we may process
additional data about you based on public interest grounds to ensure
our Services are not used fraudulently or for other
illicit activities.

Resellers, Channel Partners, Joint Marketing Partners, and Social
Media Platforms: We collect information about your publically
available social media profile, interests or preferences, and
page-view information from some business partners with which we
operate co-branded services or joint offerings. There are multiple
purposes for collecting this information. First, we process such
information under a legitimate interest to better understand you
and/or maintain and improve the accuracy of the records we hold
about you as well as to position, promote or optimise our Services.
In addition, we may also use this information in conjunction with
your browsing habits / preferences (as obtained from our
data partners) and your contact details, professional information
and CB transaction history to deliver targeted advertising and
marketing to you, where permitted by applicable law and in
accordance with your advertising / marketing preferences. Second, we
also process such information to provide support to you as part of
our contractual obligations to you. Lastly, we process such
information in the public interest because it helps us monitor,
prevent and detect fraud.

Once we obtain such information from third parties, we do not
subsequently share it with any other third parties except as described
in this Privacy Policy. This information is shared with CB's processors
and corporate group as necessary to perform the Services.

COLLECTION & USE OF INFORMATION COLLECTED AUTOMATICALLY

We receive and store certain types of information automatically, such as
whenever you interact with the Sites or use the Services. This
information does not necessarily reveal your identity directly but may
include information about the specific device you are using, such as the
hardware model, operating system version, web-browser software (such as
Firefox, Safari, or Internet Explorer) and your Internet Protocol (IP)
address/MAC address/device identifier.

For example, we automatically receive and record information on our
server logs from your browser, including how you came to and used the
Services; your IP address; device type and unique device identification
numbers, device event information (such as crashes, system activity and
hardware settings, browser type, browser language, the date and time of
your request and referral URL), broad geographic location (e.g. country
or city-level location) and other technical data collected through
cookies, pixel tags and other similar technologies that uniquely
identify your browser. We may also collect information about how your
device has interacted with our website, including pages accessed and
links clicked. We may use identifiers to recognise you when you arrive
at the Site via an external link, such as a link appearing on a third
party site.

HOW WE PROTECT AND STORE PERSONAL INFORMATION

We understand how important your privacy is, which is why CB maintains
(and requires its service providers to maintain) appropriate physical,
technical and administrative safeguards to protect the security and
confidentiality of the personal information you entrust to us.

We may store and process all or part of your personal and transactional
information, including certain payment information, such as your
encrypted bank account and/or routing numbers, in the United States and
elsewhere in the world where our facilities or our service providers are
located. We protect your personal information by maintaining physical,
electronic, and procedural safeguards in compliance with the applicable
laws and regulations.

For example, we use computer safeguards such as firewalls and data
encryption, we enforce physical access controls to our buildings and
files, and we authorise access to personal information only for those
employees who require it to fulfill their job responsibilities. Full
credit card data is securely transferred and hosted off-site by a
payment vendor in compliance with Payment Card Industry Data Security
Standards (PCI DSS). This information is not accessible to CB or
Coinbase staff.

However, we cannot guarantee that loss, misuse, unauthorised
acquisition, or alteration of your data will not occur. Please recognise
that you play a vital role in protecting your own personal information.
When registering with our Services, it is important to choose a password
of sufficient length and complexity, to not reveal this password to any
third-parties, and to immediately notify us if you become aware of any
unauthorised access to or use of your account.

Furthermore, we cannot ensure or warrant the security or confidentiality
of information you transmit to us or receive from us by Internet or
wireless connection, including email, phone, or SMS, since we have no
way of protecting that information once it leaves and until it reaches
us. If you have reason to believe that your data is no longer secure,
please contact us at the email address, mailing address or telephone
number listed at the end of this Privacy Policy.

HOW WE SHARE PERSONAL INFORMATION WITH OTHER PARTIES

We take care to allow your personal information to be accessed only by
those who really need to in order to perform their tasks and duties, and
to share with third parties who have a legitimate purpose for accessing
it. CB will never sell or rent your personal information. We will only
share your data in the following circumstances:

We share your information with third party identity verification services in order to prevent fraud. This allows CB to confirm your identity by comparing the information you provide us to public records and other third party databases.

We may share your information with service providers under contract who help with parts of our business operations such as bill collection, marketing, and technology services. Our contracts require these service providers to only use your information in connection with the services they perform for us, and prohibit them from selling your information to anyone else.

We share your information with financial institutions with which we partner to process payments you have authorised.

We may share your information with companies or other entities that we plan to merge with or be acquired by. Should such a combination occur, we will require that the new combined entity follow this Privacy Policy with respect to your personal information. You will receive prior notice of any change in applicable policies.

We may share your information with companies or other entities that purchase CB assets pursuant to a court-approved sale under U.S. bankruptcy law and / or where we are required to share your information pursuant to insolvency law in the U.K. or in any other jurisdiction;

We may share your information with any third parties where required to do so by applicable law or any court or other authority to which we are subject in any jurisdiction; or we believe in good faith that the disclosure of personal information is necessary to prevent physical harm or financial loss, to report suspected illegal activity or to investigate violations of the CB User Agreement and any other applicable policies.a

We may share your information with other third parties with your consent or direction to do so.

If you establish a CB Account indirectly on a third party website or via
a third party application, any information that you enter on that
website or application (and not directly on a CB website) will be shared
with the owner of the third party website or application and your
information will be subject to their privacy policies.

HOW PERSONAL INFORMATION IS SHARED WITH THIRD-PARTY SITES AND SERVICES

If you use your CB Account to transfer Digital Currency in connection
with the purchase or sale of goods or services, we or you may also
provide the seller with your shipping address, name, and/or email to
help complete your transaction with the seller. The seller is not
allowed to use this information to market their services to you unless
you have agreed to it. If an attempt to transfer Digital Currency to
your seller fails or is later invalidated, we may also provide your
seller with details of the unsuccessful transfer. To facilitate dispute
resolutions, we may provide a buyer with the seller's address so that
goods can be returned to the seller.

In connection with a Digital Currency transfer between you and a third
party, including merchants, a third party may share information about
you with us, such as your email address or mobile phone number which may
be used to inform you that a transfer has been sent to or received from
the third party. We may use this information in connection with such
transfers to confirm that you are a CB customer, that Digital Currency
transfers are enabled, and/or to notify you that you have received
Digital Currency. If you request that we validate your status as a CB
customer with a third party, we will do so. You may also choose to send
Digital Currency to or request Digital Currency from an email address.
In such cases, your user name will be displayed in an email message
notifying the user of the designated email address of your action.

Please note that merchants you interact with may have their own privacy
policies, and CB is not responsible for their operations, including, but
not limited to, their information practices. Information collected by
third parties, which may include such things as contact details or
location data, is governed by their privacy practices. We encourage you
to learn about the privacy practices of those third parties.

If you authorise one or more third-party applications to access your CB
Account, then information you have provided to CB may be shared with
those third parties. Unless you provide further authorisation, these
third parties are not allowed to use this information for any purpose
other than to facilitate your transactions using CB Services.

SPECIFIC CONSENT BY USERS IN SINGAPORE

If you are located in, or a resident of, Singapore, you specifically and
voluntarily consent to the transfer of your personal information to our
related entity and service providers in the USA, for the specific
purposes of performing identity verification or checking, to enable us
to prevent fraud and comply with our legal obligations.

The USA may not have protections in place for personal data as extensive
as those within Singapore. However, we require our service providers,
including Coinbase, Inc., to treat your personal information in strict
confidence and use appropriate security measures to protect it. We also
require them to uphold all of our other obligations under this Privacy
Policy.

You may revoke your consent to this section at any time by
emailing trust@coinbase.com with the subject line "Revoke Singapore
data consent".

HOW YOU CAN ACCESS OR CHANGE YOUR PERSONAL INFORMATION

You are entitled to review, correct, or amend your personal information,
or to delete that information where it is inaccurate. You may do this at
any time by logging in to your account and clicking the Profile or My
Account tab. This right shall only be limited where the burden or
expense of providing access would be disproportionate to the risks to
your privacy in the case in question, or where the rights of persons
other than you would be violated.

If you close your Coinbase Account, we will mark your account in our
database as "Closed," but will keep your account information in our
database for a period of time as allowed by applicable law. This is
necessary in order to deter fraud, by ensuring that persons who try to
commit fraud will not be able to avoid detection simply by closing their
account and opening a new account. However, if you close your account,
your personal information will not be used by us for any further
purposes, nor sold or shared with third parties, except as necessary to
prevent fraud and assist law enforcement, as required by law, or in
accordance with this Privacy Policy.

RIGHTS in RELATION TO THE USE OF YOUR PERSONAL INFORMATION

Rights of access, correction and deletion

You have a right of access to the personal information that we hold
about you under European data protection legislation, and to some
related information. You can also require any inaccurate personal
information to be corrected or deleted.

Right to object

You can object to our use of your personal information for direct
marketing purposes at any time and you may have the right to object to
our processing of some or all of your personal information (and require
them to be deleted) in some other circumstances.

If you wish to exercise any of these rights, please contact us as set
out below.

RETENTION OF PERSONAL INFORMATION

CB will retain your personal data for as long as is necessary for the
purposes of our business relationship with you, to perform our
contractual obligations to you, or if longer, as required for legal and
regulatory purposes.

We have established internal policies for the deletion of data from
customer accounts following termination of a customer's subscription to
the Service.

INTERNATIONAL TRANSFERS OF PERSONAL INFORMATION

While Coinbase UK, Ltd, and CB Payments, Ltd, are based in the United
Kingdom (which is within the EEA), our service providers may store,
transfer, and otherwise process your personal information in countries
outside of the country of your residence, including the United States,
the Philippines, and possibly other countries. We use approved Model
Contractual Clauses for the international transfer of personal
information collected in the European Economic Area and Switzerland, or
require that any third party located in the U.S. receiving your personal
information is certified under the E.U.-U.S. and/or the Swiss-U.S.
Privacy Shield Frameworks and require that the third party agree to at
least the same level of privacy safeguards as required under applicable
data protection laws

If you have a complaint about our privacy practices and our collection,
use or disclosure of personal information please contact us at
trust@coinbase.com.

CHILDREN'S PERSONAL INFORMATION

We do not knowingly request to collect personal information from any
person under the age of 18. If a user submitting personal information is
suspected of being younger than 18 years of age, CB will require the
user to close his or her account and will not allow the user to continue
buying or selling digital currencies. Please notify us if you know of
any individuals under the age of 18 using our Services so we can take
action to prevent access to our Services.

CHANGES TO THIS PRIVACY POLICY

We may periodically post changes to this Privacy Policy on this page. We
encourage you to visit this page often. When required by law, we will
notify you of any changes to this Privacy Policy. If we make any
material changes we will notify you by email (sent to the e-mail address
specified in your account) or by means of a notice on our Services prior
to the change becoming effective.

HOW TO CONTACT US

If you have questions or concerns regarding this Privacy Policy, or if
you have a complaint, you should first contact us at
trust@coinbase.com, on our support
page, or by writing to us at:

CB Payments, Ltd

9th Floor, 107 Cheapside, London, EC2V 6DN

Or

Coinbase UK, Ltd

9th Floor, 107 Cheapside, London, EC2V 6DN

COMPLAINTS

You can also complain about our processing of your personal information
to the relevant data protection authority. You can complain in the EU
member state where you live or work, or in the place where the alleged
breach of data protection law has taken place. In the UK, the relevant
data protection authority is the Information Commissioner's Office
(ICO).